A MERN service needs a database URL, a port, a signing secret and a dozen feature switches, and every one differs between your laptop, the CI runner and production. The twelve-factor rule keeps those values out of the code and in the environment, so the same build artifact runs everywhere and only its inputs change.
The hard part is not loading them; it is trusting them. Everything in process.env is a string, a missing key is silently undefined, and a typo in a deployment variable surfaces as a NaN port an hour after release. This section builds a configuration module that fails loudly at startup instead — layered files, a schema, one frozen object — and covers what no validator can fix: keeping secrets out of your Git 1,932 history.